You can use Windows or Forms authentication with this method. However, the code listings included in this article will be using Forms authentication. The first step is to setup security for the application.

Listing 1 demonstrates how to set up Forms Authentication for the web site's root directory. In this application everyone can access the pages in the root directory and the security for sub directories is accomplished by using a separate Web.config file inside each directory. How to secure sub directories will be discussed later in this article.

Set the authentication mode equal to Forms. Set the forms name equal to "MenuAuth." This is the name of the cookie used for forms authentication. Then under credential, set the password format to SHA1. Later I will demonstrate how to hash the passwords to store them in the web.config file. Then for each user you set the user name and hashed password. And then under authorization, allow all users by using the asterisk (*). This example stores user names and passwords in the web.config file, but you could also use a database to store this information. You may want use a database if you have a lot of user names to store.

To use the code from this article you will need to create a new web application. Start by copying the code from Listing 1 into your favorite text editor and save it in the application's root directory. There are two users in the web.config, user1 and user2. The passwords are the same as the user names.

Listing 1 - This is the Web.config file in the web site's root directory

<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
  <system.web>
    <authentication mode="Forms">
      <forms name="MenuAuth">
        <credentials passwordFormat="SHA1">
          <user name="User1" 
           password="B3DAA77B4C04A9551B8781D03191FE098F325E67"/>
          <user name="User2" 
           password="A1881C06EEC96DB9901C7BBFE41C42A3F08E9CB4"/>
        </credentials>
      </forms>
    </authentication>
    <authorization>
      <allow users="*"/>
    </authorization>
    <compilation debug="false"/>
  </system.web>
</configuration>

Listing 2 shows the login page for the web site. The web form has an input for user name and input for password, two validators to make these required fields, a label for displaying messages to the user, and a login button. When the user clicks the login button, if both the inputs are filled in, an attempt is made to authenticate the user name and password. If authentication is successful, the user is redirected to the page they were requesting. If authentication fails, the user receives a message that the user name and password they entered are invalid and they are asked to try again. Create the Login.aspx in the application's root directory.

Listing 2 - This is the Login.aspx page

<%@ Page Language="C#" MasterPageFile="~/MasterPage.master" 
Title="Menu" Theme="Default" %>
<script runat="server">

void Login_Click(Object sender, EventArgs E)
{
  if (FormsAuthentication.Authenticate(UserName.Value.Trim(), 
      UserPass.Value.Trim()))
  {
    FormsAuthentication.RedirectFromLoginPage(UserName.Value.Trim(), false);
  }
  else
  {
    Msg.Text = "Invalid Credentials: Please try again";
  }
}

</script>
 
<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" 
  Runat="Server">
  <h3>Login Page</h3>
  <table>
  <tr>
    <td>User Name:</td>
    <td><input id="UserName" type="text" runat=server/></td>
    <td><asp:RequiredieldValidator ID="RequiredFieldValidator1" 
        ControlToValidate="UserName" Display="Static" ErrorMessage="*" 
        runat=server/></td>
  </tr>
  <tr>
    <td>Password:</td>
    <td><input id="UserPass" type=password runat=server/></td>
    <td><asp:RequiredFieldValidator ID="RequiredFieldValidator2" 
        ControlToValidate="UserPass" Display="Static" ErrorMessage="F*" 
        runat=server/></td>
  </tr>
</table>
<asp:button ID="Button1" text="Login" OnClick="Login_Click" runat=server/>
<asp:Label id="Msg" ForeColor="red" Font-Size="10" runat=server />
</asp:Content>

Hash Password

The passwords must be hashed before you can store them in the web.config file or a database. Listing 3 is a web page that will let you enter a password; click the hash password button and the hashed version of your password is displayed in a label. It is then ready to be copied and stored in the configuration file. The hasing is accomplished by using the FormsAuthentication HashPasswordForStoringInConfigFile event. One note of caution you must use the same format in this hashing web page that you have in the web.config file or the passwords will not authenticate. You can create this file in the application's root directory, but there would be no need to publish this to a live web site.

Listing 3 - This is the web page that will allow you to hash passwords (Hash.aspx)

<%@ Page Language="C#" MasterPageFile="~/MasterPage.master" Title="Hash" 
Theme="Default" %>
<script runat="server">

protected void Button1_Click(object sender, EventArgs e)
{
  Label1.Text = 
  FormsAuthentication.HashPasswordForStoringInConfigFile(TextBox1.Text, "sha1");
}

</script>
<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" 
  Runat="Server">
  <asp:TextBox ID="TextBox1" runat="server" Width="200px"></asp:TextBox>
  <asp:Button ID="Button1" runat="server" Text="Hash Password" 
  OnClick="Button1_Click" Width="100px" />
  <asp:Label ID="Label1" runat="server"></asp:Label>
</asp:Content>